How to Programmatically modify an existing Open LDAP objectclass using openLDAP library APIs for C language?

Question

I am writing an Identity and Access Management application in C programming language. So I use openLDAP for persisting user details and it provides a set of APIs to perform operations such as bind, add, search, modify etc. I created a new object class to hold my Application's user details as bellow,

attributetype ( 2.5.4.1 NAME 'id'
    DESC 'RFC2256: user identifier'
    EQUALITY caseIgnoreMatch
    SUBSTR caseIgnoreSubstringsMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )

attributetype ( 2.5.4.2 NAME 'name'
    DESC 'RFC2256: user name'
    EQUALITY caseIgnoreMatch
    SUBSTR caseIgnoreSubstringsMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )

attributetype ( 2.5.4.3 NAME 'email'
    DESC 'RFC2256: user mail address'
    EQUALITY caseIgnoreMatch
    SUBSTR caseIgnoreSubstringsMatch
    SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} )


objectclass ( 2.5.4.4 NAME 'user'
    DESC 'user details'
    SUP top STRUCTURAL
    MUST id
    MAY ( name $ email ) )

Is it possible to add a new attribute 'phoneNumber' to the 'user' object class without directly editing schema file but by using APIs provided by openLDAP library?

Why? `ldapmodify` already exists. – user207421 May 23 '18 at 08:30 — user207421, May 23 '18 at 08:30

jwilleke · Accepted Answer · 2018-05-28T17:38:58.697

2

The best practice would be to add an Auxiliary ObjectClass with no REQUIRED attributes and adding "MAY" attributes as needed.

After adding the AUX class to the Schema, then you can add, though a modify operation the AUX Class to any Structural ObjectClass entry as a ObjectClass value as desired.

This allows you to maintain the base schema intact.

-jim

edited May 28 '18 at 17:38

answered May 23 '18 at 09:58

jwilleke

10,467
1
30
51

This is ok. But my question is about adding attributes to an existing objectclass (AUX) dynamically using openLDAP library for C programming language. we can bind to LDAP server by using API ldap_bind() , search a directory entry using ldap_search() API, is there any similar API available to add an attribute to an objectclass. I don't want to add it using some LDIF file or from the terminal using some commands but I need to know is there any API for this available or not? Hope you are clear. Thanks – Ajith C Narayanan May 28 '18 at 06:39

score 1 · Answer 2 · edited Oct 07 '21 at 11:07

Not what you've asked for. But it's important so others do not naively copy&paste this:

attributetype ( 2.5.4.*

[..]

objectclass ( 2.5.4.4 NAME 'user'

You're abusing OIDs already assigned to other schema descriptions. This is broken. You will not be able to load any data with that.

With OpenLDAP's dynamic configuration you can add/modify schema on the fly if you follow the rules in RFC 4512 for defining attribute types and object classes.

See also: cn=schema

Note that removing schema descriptions in case there's already existing data using it is a no-no.

score 1 · Answer 3 · answered Jan 16 '19 at 01:12

The LDAP standards are written for schema to be Write Once Read Many data - once you set something, you can't unset it. As a result, many LDAP servers are very resistant to changing their schema elements like you're talking about.

Of course, for many of us, that attitude is an academic luxury we can't afford, so we do make changes to our schema, despite how much it horrifies our LDAP vendors.

However, we change our schema, not the standard schema. Changing standard objectclasses is a no-no, because whatever changes you make to the default standard will go away without warning sometimes when you update your LDAP server software. And even when restricting yourself to editing objectclasses that are yours to edit, you will still probably have to update the schema files directly and then have the ldap server load the new files, rather than just asking it nicely to update its schema elements.

Of course, different LDAP servers have different levels of orneriness on this. For example back when we used iPlanet LDAP, if I recall correctly, it would let us do a delete & add of an objectclass that wasn't in use, and make changes to it like that. (Don't use iPlanet LDAP; it was the product of a joint venture that fell apart over 15 years ago.)

Note: changing the standard schema is bad for more reasons than I gave. I just chose to give only the reason I felt is likely to have purchase with the OP, based on other developers I've talked to who suggested making changes to standard objectclasses. — Ed Grimm, Jan 16 '19 at 01:14

How to Programmatically modify an existing Open LDAP objectclass using openLDAP library APIs for C language?

3 Answers3